@pipeworx/mcp-greynoise 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pipeworx
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,55 @@
+# mcp-greynoise
+
+GreyNoise Community MCP — internet scanner classification (free tier with key)
+
+Part of [Pipeworx](https://pipeworx.io) — an MCP gateway connecting AI agents to 250+ live data sources.
+
+## Tools
+
+| Tool | Description |
+|------|-------------|
+
+## Quick Start
+
+Add to your MCP client (Claude Desktop, Cursor, Windsurf, etc.):
+
+```json
+{
+  "mcpServers": {
+    "greynoise": {
+      "url": "https://gateway.pipeworx.io/greynoise/mcp"
+    }
+  }
+}
+```
+
+Or connect to the full Pipeworx gateway for access to all 250+ data sources:
+
+```json
+{
+  "mcpServers": {
+    "pipeworx": {
+      "url": "https://gateway.pipeworx.io/mcp"
+    }
+  }
+}
+```
+
+## Using with ask_pipeworx
+
+Instead of calling tools directly, you can ask questions in plain English:
+
+```
+ask_pipeworx({ question: "your question about Greynoise data" })
+```
+
+The gateway picks the right tool and fills the arguments automatically.
+
+## More
+
+- [All tools and guides](https://github.com/pipeworx-io/examples)
+- [pipeworx.io](https://pipeworx.io)
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@pipeworx/mcp-greynoise",
+  "version": "0.1.0",
+  "description": "GreyNoise Community MCP — internet scanner classification (free tier with key)",
+  "type": "module",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "keywords": ["mcp", "mcp-server", "model-context-protocol", "pipeworx", "greynoise"],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pipeworx-io/mcp-greynoise"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0"
+  }
+}

package/server.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.pipeworx-io/greynoise",
+  "title": "Greynoise",
+  "description": "GreyNoise Community MCP — internet scanner classification (free tier with key)",
+  "version": "0.1.0",
+  "websiteUrl": "https://pipeworx.io/packs/greynoise",
+  "repository": {
+    "url": "https://github.com/pipeworx-io/mcp-greynoise",
+    "source": "github"
+  },
+  "remotes": [
+    {
+      "type": "streamable-http",
+      "url": "https://gateway.pipeworx.io/greynoise/mcp"
+    }
+  ]
+}

package/src/index.ts

@@ -0,0 +1,115 @@
+interface McpToolDefinition {
+  name: string;
+  description: string;
+  inputSchema: {
+    type: 'object';
+    properties: Record<string, unknown>;
+    required?: string[];
+  };
+}
+
+interface McpToolExport {
+  tools: McpToolDefinition[];
+  callTool: (name: string, args: Record<string, unknown>) => Promise<unknown>;
+  meter?: { credits: number };
+  cost?: Record<string, unknown>;
+  provider?: string;
+}
+
+/**
+ * GreyNoise Community MCP — internet scanner classification (free tier with key)
+ *
+ * GreyNoise separates "internet background noise" (mass scanners, search
+ * engines, benign crawlers) from targeted activity. When triaging an alert,
+ * checking the source IP against GreyNoise tells you whether you're seeing
+ * targeted intent or one of the billions of daily opportunistic probes.
+ *
+ * Pairs with: shodan-internetdb (what the IP is running), abuseipdb (community
+ * abuse reports), nvd (vulns related to surfaced services).
+ *
+ * API: https://docs.greynoise.io/reference/community-api
+ * Tools:
+ * - ip_context: noise/RIOT classification, name, last seen, link
+ */
+
+
+const BASE_URL = 'https://api.greynoise.io/v3/community';
+
+const tools: McpToolExport['tools'] = [
+  {
+    name: 'ip_context',
+    description:
+      'Look up an IPv4 against the GreyNoise Community dataset. Returns noise (is the IP scanning the internet?), riot (is it a known good service like Google/Microsoft?), classification (malicious | benign | unknown), name, last-seen date, and a deep link. Useful for noise-suppression in SOC alerts.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ip: { type: 'string', description: 'IPv4 address' },
+      },
+      required: ['ip'],
+    },
+  },
+];
+
+async function callTool(name: string, args: Record<string, unknown>): Promise<unknown> {
+  const apiKey = (args._apiKey as string | undefined)?.trim();
+  if (!apiKey) {
+    throw new Error(
+      'GreyNoise requires an API key. Contact the operator about platform credentials, or BYO via ?_apiKey=<key> after registering a free Community account at https://viz.greynoise.io',
+    );
+  }
+  switch (name) {
+    case 'ip_context':
+      return ipContext(apiKey, String(args.ip).trim());
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+}
+
+interface CommunityResponse {
+  ip?: string;
+  noise?: boolean;
+  riot?: boolean;
+  classification?: string;
+  name?: string;
+  link?: string;
+  last_seen?: string;
+  message?: string;
+}
+
+async function ipContext(apiKey: string, ip: string) {
+  if (!ip) throw new Error('ip is required');
+  const res = await fetch(`${BASE_URL}/${encodeURIComponent(ip)}`, {
+    headers: { key: apiKey, Accept: 'application/json' },
+  });
+  if (res.status === 401 || res.status === 403) throw new Error('GreyNoise: unauthorized — check the API key');
+  if (res.status === 429) throw new Error('GreyNoise: rate-limit hit (HTTP 429)');
+  if (res.status === 404) {
+    // GreyNoise returns 404 for IPs they have no observation of — surface as a structured result
+    return {
+      ip,
+      observed: false,
+      noise: false,
+      riot: false,
+      classification: 'unknown',
+      message: 'IP not observed in GreyNoise (no scanner activity recorded)',
+    };
+  }
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`GreyNoise error: ${res.status} ${body.slice(0, 200)}`);
+  }
+  const data = (await res.json()) as CommunityResponse;
+  return {
+    ip: data.ip ?? ip,
+    observed: true,
+    noise: data.noise ?? false,
+    riot: data.riot ?? false,
+    classification: data.classification ?? 'unknown',
+    name: data.name ?? null,
+    last_seen: data.last_seen ?? null,
+    link: data.link ?? `https://viz.greynoise.io/ip/${ip}`,
+    message: data.message ?? null,
+  };
+}
+
+export default { tools, callTool, meter: { credits: 1 } } satisfies McpToolExport;

package/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "outDir": "dist",
+    "rootDir": "src",
+    "declaration": true
+  },
+  "include": ["src"]
+}